---
title: "Customiser Privacy Policy"
description: "How Customiser handles personal data: what we collect and why, who processes it, how long we keep it, how AI uses your documents, and your rights."
url: "https://customiser.ai/privacy"
modified: "2026-09-30"
---

# Privacy Policy

Last updated: 30 September 2026

## 1. Who we are

This policy explains how Customiser AI Ltd, a company registered in England and Wales under company number 16814294, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("Customiser", "we", "us"), handles personal data when you use our website (customiser.ai), our estimating and quoting software (app.customiser.ai, the "Service"), or contact us.

- We are the **controller** of personal data about our users, website visitors and business contacts: account details, billing, support and usage.
- We are a **processor** for personal data that our customers put into the Service as part of their content, such as contact details of their own customers or names printed on drawings. We process it only on our customer's instructions. If your data is in a customer's account, please contact that customer first.

Contact for anything in this policy: [team@customiser.ai](mailto:team@customiser.ai).

## 2. What we collect

- **Account details:** your name, email address, organisation name, role and sign-in information. Sign-in is provided by our authentication provider, and we never see your password.
- **Your content:** the documents you upload (drawings, bills of materials, specifications, requests for quotation, emails) and what the Service produces from them. This includes customer and supplier records you create, which can contain names, job titles, email addresses and phone numbers.
- **Billing information:** credit purchases, invoices and receipts. Card details are collected and held by our payment processor, not by us.
- **Usage and credits:** which features you use, the pages read and AI processing performed for each job, and the credits used.
- **Support and feedback:** messages you send us and, to help us answer, the page, job and app version you were on when you sent them.
- **Technical data:** IP address, browser and device information, logs and error reports, used to run and secure the website and the Service.
- **Demo bookings:** if you book a demo through the calendar on customiser.ai, your name, position, company, company email, country, phone number, industry, message and time zone, and any guests you add. The calendar is run by Cal.com, which passes the booking to us.
- **Website forms:** what you send through the forms on customiser.ai. That is your work email if you join the waitlist; your name, role, company, work email, country, phone number, industry and message if you request a demo; and, if you introduce a company through our referral programme, your name and email and the name, role, phone number and company of the person you introduce.

## 3. How we use it and our legal bases

- To provide the Service, run your account and process purchases (performance of our contract with you or your organisation).
- To keep the Service secure, prevent abuse and fix errors (our legitimate interests in running a safe, reliable service).
- To answer support requests and send service messages, such as receipts, security notices and notices of changes to our terms (contract and legitimate interests).
- To answer enquiries and demo requests sent through our website, to schedule and hold the demo calls you book, and to run our referral programme (our legitimate interests in responding to and building business relationships).
- To tell you when Customiser opens, if you join the waitlist (consent, which you can withdraw at any time by asking us to remove you).
- To understand how the Service is used and improve it, using aggregated measurements that do not reveal your content (legitimate interests).
- To send product news, only where you have agreed or where the law otherwise allows; you can unsubscribe at any time (consent or legitimate interests).
- To meet our legal obligations, such as tax records and responding to lawful requests (legal obligation).

We do not sell personal data. We do not use your content for advertising, and we do not use your content to train artificial intelligence models.

If you introduce someone through our referral programme, please make sure they are happy for us to contact them. When we first get in touch, we tell them how we got their details.

## 4. How AI features handle your data

- When a task needs AI, we send the parts of your documents that the task requires (extracted text, and for scanned pages, page images) to our AI provider, Anthropic, and receive the result.
- Anthropic does not use this data to train its models, and handles it under its commercial terms.
- We keep a record of each AI step (the request, the result and a summary of the reasoning) for 90 days, so the Service can show why it suggested something and we can fix problems. The resulting suggestions and decisions stay with the job until the job is deleted.
- Our staff only look at these records to support you when you ask or allow us to, or where needed for security.
- Documents carrying export-control markings are held back from AI processing until an owner of the organisation reviews them.

## 5. Who we share data with

We use the providers below to run the Service. Each processes data only on our instructions, under a contract with data protection terms.

| Provider | What they do for us | Where |
| --- | --- | --- |
| Railway | Runs the application and document processing | United States |
| Replit | Hosts the website, customiser.ai | United States (Google Cloud) |
| Vercel | Hosts and delivers the web app | United States and global delivery network |
| Neon | Database and file storage | United States (AWS us-east-1) |
| Clerk | Sign-in and organisation accounts | United States |
| Anthropic | AI processing | United States |
| Sentry | Error monitoring | United States |
| Resend | Sending service emails | United States |
| Stripe | Payments for credit purchases | United States and Ireland |
| Google Workspace | Our business email, calendar and video calls (Google Meet) | United States |
| Cal.com | Runs the demo booking calendar on customiser.ai and sends booking emails | United States |
| Formspree | The waitlist, contact and referral forms on customiser.ai | United States |

We may also share data with professional advisers, with a buyer or successor if our business is sold or reorganised (you will be told), or where the law requires it. We will update this list before adding a provider that processes customer content.

## 6. International transfers

Our providers store and process data mainly in the United States. When we transfer personal data from the United Kingdom or the European Economic Area, we rely on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, or on the provider's certification under the Data Privacy Framework, where applicable.

## 7. How long we keep data

- **Your content and jobs:** until you delete the job or your organisation's account. Owners can also set a shorter retention period for documents in Settings.
- **When an organisation's account is closed:** we keep its data for 30 days in case the closure was a mistake, then permanently delete its database records and files.
- **AI step records:** 90 days.
- **Account details:** while the account is active, then deleted with the organisation.
- **Audit logs of important actions** (for example who approved a quote): kept for security and accountability. Customer and company names in them are stored only as irreversible codes.
- **Billing records:** for as long as tax law requires (currently six years in the UK).
- **Support messages:** 24 months.
- **Waitlist sign-ups:** until we invite you to Customiser, or sooner if you ask us to remove you.
- **Website enquiries, demo bookings and referrals:** 24 months from our last contact, unless they lead to a customer relationship.
- **Technical logs and error reports:** up to 90 days.
- **Backups:** deleted data can remain in our providers' backups for up to 30 days before it is overwritten.

## 8. Security

- Data is encrypted in transit (TLS) and encrypted at rest by our hosting providers.
- Each organisation's data is separated by access rules enforced in the database itself, so one organisation cannot read another's data even if an application query is wrong.
- Access is limited by role, important actions are recorded in an audit log, and two-step sign-in is available.

No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

## 9. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to our use of it, receive a copy in a portable format, and withdraw consent at any time. California residents have the right to know what we collect, to delete it, and not to be discriminated against for using these rights; we do not sell or share personal data for cross-context behavioural advertising.

To use your rights, email [team@customiser.ai](mailto:team@customiser.ai). We will reply within 30 days. For personal data in a customer's account (where we are a processor), we will pass your request to that customer and help them answer it.

## 10. Cookies

The Service uses only the cookies it needs to keep you signed in and secure. Our website, customiser.ai, uses no analytics, advertising or marketing cookies. Its hosting sets one technical cookie, GAESA, which routes your visits through Google Cloud's load balancing and expires after 30 days. The booking calendar on our contact page is provided by Cal.com and loads from its servers, on that page only. Cal.com sets the cookies and similar storage it needs to run the booking form, such as a security token and a bot-protection cookie; its privacy policy has the details.

## 11. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children.

## 12. Changes to this policy

We will post any changes on this page and update the date above. If a change is significant, we will also tell organisation owners by email or in the Service.

## 13. Contact and complaints

Email [team@customiser.ai](mailto:team@customiser.ai), or write to Customiser AI Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. If you are not satisfied with our answer, you can complain to your data protection authority. In the UK, that is the Information Commissioner's Office ([ico.org.uk](https://ico.org.uk)).